feat: ship an opt-in Linux service example

[domcyrus]

Linux-only, opt-in systemd documentation example, restacked on #602 and related to #9.

• Ships the unit and English, Chinese, and Japanese guides as documentation in release archives, DEBs, and RPMs. Package installation never enables or starts it.
• Keeps sandboxing and root-to-nobody dropping, including systemd 255 capability handling. Clears inherited sudo identity and separates private JSONL snapshots from journal diagnostics. Includes shutdown and retention guidance.
• Consolidates feat: add opt-in headless services #603's useful Linux documentation and validation. Windows SCM, launchd, and FreeBSD services are deferred. CI inspects package contents and exercises the unit with synthetic loopback traffic.

Verified: release DEB/RPM and native RPM contents, Debian documentation staging, archive contents, and a real systemd SIGTERM run with private output, nobody UID, and clean final JSONL.

[domcyrus]

#606 replaces this PR and preserves the same service changes. It targets #602. The incorrect base-branch push was reversed, and no service changes reached main.